# CVE-2026-68945: Angular HttpTransferCache cache-key ambiguity in SSR

Source: https://junglewise.ai/threats/cve-2026-68945-angular-httptransfercache-cache-key-ambiguity-in-ssr  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-68945 · Severity: high · CVSS 4 · Published 2026-08-03

Angular's server-side rendering component contains a flaw in how it caches web requests. This can allow an attacker to trick the system into reusing a previous, potentially public response for a sensitive request, such as an authorization check. This could lead to unauthorized data access or the application operating on incorrect, attacker-influenced information.

Technologies: [@angular/common (npm)](https://junglewise.ai/threats/technologies/npm-angular-common). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-68945 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68945 being exploited in the wild.

**How severe is CVE-2026-68945?** High severity, with a CVSS score of 4, published 3 August 2026.

**Which products and versions are affected?** @angular/common (npm) SEMVER:introduced=22.0.0-next.0,fixed=22.0.2.

**Is there a fix for CVE-2026-68945?** Yes. @angular/common (npm): upgrade to 22.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68945 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-68945?** Check whether you run @angular/common (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @angular/common (npm): upgrade to 22.0.2 or later

  ```sh
  npm install @angular/common@22.0.2
  ```


## Technical details

A cache-key ambiguity exists in Angular's HttpTransferCache during Server-Side Rendering (SSR). The component previously serialized repeated HTTP parameters by joining them with commas (e.g., 'role=user&role=admin' and 'role=user,admin' both became 'role=user,admin'), resulting in identical cache keys for semantically different requests. An attacker can exploit this by making a request with a comma-separated scalar value that matches the serialized key of a subsequent sensitive request (like an authorization check). If the cache is hit, the application may reuse the attacker-influenced response instead of fetching fresh data from the backend. This is patched in versions 22.0.2, 21.2.19, and 20.3.27.

## Affected products

- Angular @angular/common >= 22.0.0-next.0, < 22.0.2; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25

## Identifiers

- CVE-2026-68945
- GHSA-jhpw-976m-542j

## Timeline

- 2026-07-29: disclosed: Vulnerability published to angular/angular repository
- 2026-08-03: advisory: GitHub Advisory GHSA-jhpw-976m-542j published

## References

- [https://api.github.com/users/Hexix23](https://api.github.com/users/Hexix23)
- [https://github.com/Hexix23](https://github.com/Hexix23)
- [https://api.github.com/users/Hexix23/gists%7B/gist_id%7D](https://api.github.com/users/Hexix23/gists%7B/gist_id%7D)
- [https://api.github.com/users/Hexix23/repos](https://api.github.com/users/Hexix23/repos)
- [https://avatars.githubusercontent.com/u/62616592?v=4](https://avatars.githubusercontent.com/u/62616592?v=4)
- [https://api.github.com/users/Hexix23/events%7B/privacy%7D](https://api.github.com/users/Hexix23/events%7B/privacy%7D)

## Related threats

- [Angular common XSRF token leakage via URL parsing discrepancy](https://junglewise.ai/threats/cve-2026-111753-angular-common-xsrf-token-leakage-via-url-parsing-discrepancy-in)
- [Angular information leak in HttpTransferCache with hierarchical HttpClient](https://junglewise.ai/threats/cve-2026-88059-angular-information-leak-in-httptransfercache-with-hierarchical)
- [Google Angular Denial of Service in @angular/common number formatting](https://junglewise.ai/threats/cve-2026-50171-google-angular-denial-of-service-in-angular-common-number)
- [Google Angular information disclosure in @angular/common HttpTransferCache](https://junglewise.ai/threats/cve-2026-50170-google-angular-information-disclosure-in-angular-common)
- [Google Angular weak hashing in HttpTransferCache cache keys](https://junglewise.ai/threats/cve-2026-54266-google-angular-weak-hashing-in-httptransfercache-cache-keys)